@themoltnet/pi-extension 0.5.0 → 0.7.0

package/dist/index.d.ts

@@ -33,6 +33,8 @@ declare interface ClaimedTask {
     task: Task;
     /** Attempt number assigned by the source/queue. */
     attemptN: number;
+    /** W3C trace headers from the claim response for OTel context propagation. */
+    traceHeaders: Record<string, string>;
 }
 
 export declare function computePiJudgeRecipeCid(inputs: PiJudgeRecipeInputs): PiJudgeRecipeCid;
@@ -50,6 +52,8 @@ export declare function createGondolinWriteOps(vm: VM, localCwd: string): WriteO
  */
 export declare function createMoltNetTools(config: MoltNetToolsConfig): ToolDefinition<any, any>[];
 
+export declare function createPiOtelExtension(options?: PiOtelOptions): (pi: ExtensionAPI) => void;
+
 /**
  * Factory that builds a pi-specific `executeTask` function suitable for
  * injection into `AgentRuntime`. The returned function caches the resolved
@@ -132,6 +136,7 @@ export default moltnetExtension;
 declare interface MoltNetToolsConfig {
     getAgent(): MoltNetAgent | null;
     getDiaryId(): string | null;
+    getTeamId(): string | null;
     getSessionErrors(): readonly TrackedError[];
     clearSessionErrors(): void;
     /** Host working directory for host-exec commands (worktree path or cwd). */
@@ -183,6 +188,17 @@ declare interface PiJudgeRecipeVersions {
     sdk: string | null;
 }
 
+export declare interface PiOtelOptions {
+    /** Agent name for `gen_ai.agent.name` on the root span. */
+    agentName?: string;
+    /**
+     * Extra attributes merged onto every span. Use MoltNet-specific keys
+     * like `moltnet.task.id` — any `gen_ai.*` keys here are filtered out
+     * since the extension is authoritative for those.
+     */
+    spanAttributes?: Record<string, string | number | boolean>;
+}
+
 export declare function resolvePiJudgeRecipeVersions(): PiJudgeRecipeVersions;
 
 /**

package/dist/index.js

@@ -3,14 +3,15 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
 import path, { join } from "node:path";
 import { DefaultResourceLoader, SessionManager, createAgentSession, createBashTool, createBashToolDefinition, createEditTool, createEditToolDefinition, createReadTool, createReadToolDefinition, createWriteTool, createWriteToolDefinition, defineTool } from "@mariozechner/pi-coding-agent";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash } from "node:crypto";
 import crypto, { createHash as createHash$1 } from "crypto";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { Type, complete, getModel } from "@mariozechner/pi-ai";
-import { fileURLToPath } from "node:url";
 import { RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, loadGuestAssets } from "@earendil-works/gondolin";
 import { parseEnv } from "node:util";
+import { fileURLToPath } from "node:url";
+import { SpanStatusCode, context, trace } from "@opentelemetry/api";
 import { FormatRegistry, Type as Type$1 } from "@sinclair/typebox";
 import { Value } from "@sinclair/typebox/value";
 //#region ../api-client/src/generated/core/bodySerializer.gen.ts
@@ -1415,80 +1416,6 @@ var updateRenderedPack = (options) => (options.client ?? client).patch({
 	}
 });
 /**
-* Trigger fidelity verification for an agent-rendered pack.
-*/
-var verifyRenderedPack = (options) => (options.client ?? client).post({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/rendered-packs/{id}/verify",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
-});
-/**
-* Judge claims verification payload (source entries, rendered content, and rubric).
-*/
-var claimVerification = (options) => (options.client ?? client).post({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/rendered-packs/{id}/verify/claim",
-	...options
-});
-/**
-* Judge submits fidelity scores and transcript.
-*/
-var submitVerification = (options) => (options.client ?? client).post({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/rendered-packs/{id}/verify/submit",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
-});
-/**
 * Get an agent's public profile by key fingerprint (A1B2-C3D4-E5F6-G7H8).
 */
 var getAgentProfile = (options) => (options.client ?? client).get({
@@ -6445,29 +6372,6 @@ function createPacksNamespace(context) {
 				body
 			}));
 		},
-		async verifyRendered(id, body) {
-			return unwrapResult(await verifyRenderedPack({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
-		async claimVerification(id) {
-			return unwrapResult(await claimVerification({
-				client,
-				auth,
-				path: { id }
-			}));
-		},
-		async submitVerification(id, body) {
-			return unwrapResult(await submitVerification({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
 		async create(diaryId, body) {
 			return unwrapResult(await createDiaryCustomPack({
 				client,
@@ -6618,12 +6522,24 @@ function createTasksNamespace(context) {
 			}));
 		},
 		async claim(id, body) {
-			return unwrapResult(await claimTask({
+			const result = await claimTask({
 				client,
 				auth,
 				path: { id },
 				body
-			}));
+			});
+			const data = unwrapResult(result);
+			const traceHeaders = {};
+			const traceparent = result.response.headers.get("traceparent");
+			if (traceparent) {
+				traceHeaders["traceparent"] = traceparent;
+				const tracestate = result.response.headers.get("tracestate");
+				if (tracestate) traceHeaders["tracestate"] = tracestate;
+			}
+			return {
+				...data,
+				traceHeaders
+			};
 		},
 		async heartbeat(id, n, body) {
 			return unwrapResult(await taskHeartbeat({
@@ -7155,21 +7071,6 @@ var registerSandboxCommand = (pi, state) => {
 };
 //#endregion
 //#region src/moltnet/judge/assets.ts
-/**
-* Judge assets — single source of truth.
-*
-* `DEFAULT_RUBRIC` and `JUDGE_SYSTEM_PROMPT` below ARE the assets. There are
-* no companion `.md` files; tsc does not copy non-TS files into `dist/`, and
-* keeping a parallel markdown copy invited drift between source-of-truth
-* versions, which is what previously happened.
-*
-* The asset path constants are opaque identifiers used in the judge-recipe
-* CID manifest so verifiers can trace which asset set a given Pi extension
-* version emitted. They are NOT filesystem paths and are never read.
-* Bump the version suffix when you change the corresponding constant.
-*/
-var RUBRIC_ASSET_PATH = "pi-extension/judge/rubric@v1";
-var JUDGE_PROMPT_ASSET_PATH = "pi-extension/judge/system-prompt@v1";
 /** Default fidelity rubric — kept verbatim from the Go judge. */
 var DEFAULT_RUBRIC = `Evaluate the rendered content against the source entries on three axes:
 
@@ -7322,135 +7223,6 @@ function buildSourceEntriesMarkdown(entries) {
 	return parts.join("\n");
 }
 //#endregion
-//#region src/moltnet/judge-recipe-cid.ts
-var require = createRequire(import.meta.url);
-var SELF_PACKAGE_NAME = "@themoltnet/pi-extension";
-var PI_PACKAGE_NAME = "@mariozechner/pi-coding-agent";
-var SDK_PACKAGE_NAME = "@themoltnet/sdk";
-var CID_VERSION = 1;
-var RAW_CODEC = 85;
-var SHA2_256_CODE = 18;
-var BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
-function findSelfPackageDir() {
-	const start = path.dirname(fileURLToPath(import.meta.url));
-	let dir = start;
-	while (true) {
-		const candidate = path.join(dir, "package.json");
-		if (existsSync(candidate)) {
-			if (JSON.parse(readFileSync(candidate, "utf8")).name === SELF_PACKAGE_NAME) return dir;
-		}
-		const parent = path.dirname(dir);
-		if (parent === dir) return start;
-		dir = parent;
-	}
-}
-var PACKAGE_DIR = findSelfPackageDir();
-function sha256Hex(value) {
-	return createHash("sha256").update(value, "utf8").digest("hex");
-}
-function encodeVarint(value) {
-	const bytes = [];
-	let current = value >>> 0;
-	while (current >= 128) {
-		bytes.push(current & 127 | 128);
-		current >>>= 7;
-	}
-	bytes.push(current);
-	return bytes;
-}
-function base32Lower(bytes) {
-	let bits = 0;
-	let value = 0;
-	let output = "";
-	for (const byte of bytes) {
-		value = value << 8 | byte;
-		bits += 8;
-		while (bits >= 5) {
-			output += BASE32_ALPHABET[value >>> bits - 5 & 31];
-			bits -= 5;
-		}
-	}
-	if (bits > 0) output += BASE32_ALPHABET[value << 5 - bits & 31];
-	return `b${output}`;
-}
-function stableStringify(value) {
-	if (value === null || typeof value !== "object") return JSON.stringify(value);
-	if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
-	return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
-}
-function readPackageVersion(pkgPath, expectedName) {
-	if (!existsSync(pkgPath)) return null;
-	const parsed = JSON.parse(readFileSync(pkgPath, "utf8"));
-	if (expectedName && parsed.name !== expectedName) return null;
-	return typeof parsed.version === "string" ? parsed.version : null;
-}
-function resolveInstalledPackageVersion(packageName) {
-	const candidates = [];
-	try {
-		candidates.push(path.dirname(require.resolve(packageName)));
-	} catch {}
-	let dir = PACKAGE_DIR;
-	while (true) {
-		candidates.push(path.join(dir, "node_modules", packageName));
-		const parent = path.dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	for (const start of candidates) {
-		let current = start;
-		while (true) {
-			const version = readPackageVersion(path.join(current, "package.json"), packageName);
-			if (version) return version;
-			const parent = path.dirname(current);
-			if (parent === current) break;
-			current = parent;
-		}
-	}
-	return null;
-}
-function resolvePiJudgeRecipeVersions() {
-	return {
-		pi: resolveInstalledPackageVersion(PI_PACKAGE_NAME),
-		piExtension: readPackageVersion(path.join(PACKAGE_DIR, "package.json"), SELF_PACKAGE_NAME),
-		sdk: resolveInstalledPackageVersion(SDK_PACKAGE_NAME)
-	};
-}
-function buildPiJudgeRecipeManifest(inputs) {
-	return {
-		kind: "pi-judge-recipe/v1",
-		versions: {
-			...resolvePiJudgeRecipeVersions(),
-			...inputs.overrides
-		},
-		assets: {
-			promptAsset: inputs.promptAsset ?? null,
-			rubricAsset: inputs.rubricAsset ?? null,
-			skillSourcePath: inputs.skillSourcePath ?? null
-		},
-		hashes: {
-			judgePromptSha256: sha256Hex(inputs.judgePrompt),
-			rubricSha256: sha256Hex(inputs.rubric),
-			skillFragmentSha256: inputs.skillFragment ? sha256Hex(inputs.skillFragment) : null,
-			implementationSha256: inputs.implementationSource ? sha256Hex(inputs.implementationSource) : null
-		}
-	};
-}
-function computePiJudgeRecipeCid(inputs) {
-	const manifest = buildPiJudgeRecipeManifest(inputs);
-	const manifestBytes = Buffer.from(stableStringify(manifest), "utf8");
-	const digestBytes = createHash("sha256").update(manifestBytes).digest();
-	return {
-		cid: base32Lower(Uint8Array.from([
-			...encodeVarint(CID_VERSION),
-			...encodeVarint(RAW_CODEC),
-			...encodeVarint(SHA2_256_CODE),
-			...encodeVarint(digestBytes.length),
-			...digestBytes
-		])),
-		manifest
-	};
-}
-//#endregion
 //#region src/moltnet/render-phase6.ts
 function slugToTitle(value) {
 	return value.split(/[:/_-]+/).filter(Boolean).map((part) => part[0]?.toUpperCase() + part.slice(1)).join(" ");
@@ -7592,7 +7364,8 @@ function ensureConnected(config) {
 	if (!agent || !diaryId) throw new Error("MoltNet not connected");
 	return {
 		agent,
-		diaryId
+		diaryId,
+		teamId: config.getTeamId() ?? ""
 	};
 }
 /**
@@ -7758,24 +7531,34 @@ function createMoltNetTools(config) {
 			};
 		}
 	});
-	const verifyRenderedPack = defineTool({
-		name: "moltnet_rendered_pack_verify",
-		label: "Verify MoltNet Rendered Pack",
-		description: "Create a verification workflow for a rendered pack and return the verification ID and nonce.",
+	const createJudgePackTask = defineTool({
+		name: "moltnet_judge_pack_task_create",
+		label: "Create Judge Pack Task",
+		description: "Create a judge_pack task for a rendered pack. Returns a taskId that moltnet_rendered_pack_judge can claim and execute. The rubric is required — pass the structured rubric JSON from @moltnet/tasks Rubric schema.",
 		parameters: Type.Object({
-			renderedPackId: Type.String({ description: "Rendered pack ID" }),
-			nonce: Type.Optional(Type.String({ description: "Caller-supplied idempotency nonce. Generated automatically if omitted." }))
+			renderedPackId: Type.String({ description: "Rendered pack ID to judge" }),
+			sourcePackId: Type.String({ description: "Source pack ID. Fetch it from the rendered pack if unknown." }),
+			rubric: Type.Any({ description: "Structured rubric object (Rubric schema from @moltnet/tasks). Must have rubricId, version, criteria[]." }),
+			diaryId: Type.Optional(Type.String({ description: "Diary ID to impose the task on. Defaults to the connected diary." }))
 		}),
 		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			const nonce = params.nonce ?? randomUUID();
-			const verification = await agent.packs.verifyRendered(params.renderedPackId, { nonce });
+			const { agent, diaryId: connectedDiaryId, teamId: connectedTeamId } = ensureConnected(config);
+			const task = await agent.tasks.create({
+				taskType: "judge_pack",
+				input: {
+					renderedPackId: params.renderedPackId,
+					sourcePackId: params.sourcePackId,
+					rubric: params.rubric
+				},
+				diaryId: params.diaryId ?? connectedDiaryId,
+				teamId: connectedTeamId
+			});
 			return {
 				content: [{
 					type: "text",
 					text: JSON.stringify({
-						...verification,
-						nonce
+						taskId: task.id,
+						task
 					}, null, 2)
 				}],
 				details: {}
@@ -7785,87 +7568,79 @@ function createMoltNetTools(config) {
 	const judgeRenderedPack = defineTool({
 		name: "moltnet_rendered_pack_judge",
 		label: "Judge MoltNet Rendered Pack",
-		description: "Run the fidelity judge against a rendered pack. Local mode (no nonce): fetch the rendered pack + its source pack with entries, judge locally, return scores. Proctored mode (nonce): claim the verification payload from the API, judge, and submit scores with a Pi judge-recipe CID.",
+		description: "Claim a judge_pack task, run the fidelity judge locally, complete the task with structured scores, and set verifiedTaskId on the rendered pack. Create the task first with moltnet_judge_pack_task_create.",
 		parameters: Type.Object({
-			renderedPackId: Type.String({ description: "Rendered pack ID" }),
-			nonce: Type.Optional(Type.String({ description: "Verification nonce from moltnet_rendered_pack_verify. If set, runs proctored mode and submits scores. If omitted, runs local mode and does not submit." })),
-			rubric: Type.Optional(Type.String({ description: "Custom rubric override (local mode only). Defaults to the built-in rubric when omitted." }))
+			taskId: Type.String({ description: "judge_pack task ID from moltnet_judge_pack_task_create" }),
+			rubricOverride: Type.Optional(Type.String({ description: "Freeform rubric string override for the LLM judge prompt. When omitted the task rubric preamble (or built-in default) is used." }))
 		}),
 		async execute(_id, params, _signal, _onUpdate, ctx) {
 			const { agent } = ensureConnected(config);
 			const model = ctx?.model;
 			if (!model) throw new Error("No active model in pi session — cannot run the fidelity judge.");
-			let sourceEntriesMd;
-			let renderedContent;
-			let rubric;
-			if (params.nonce) {
-				if (params.rubric) throw new Error("`rubric` is only supported in local mode (omit `nonce`).");
-				const claim = await agent.packs.claimVerification(params.renderedPackId);
-				sourceEntriesMd = buildSourceEntriesMarkdown(claim.sourceEntries);
-				renderedContent = claim.renderedContent;
-				rubric = claim.rubric?.trim() ? claim.rubric : DEFAULT_RUBRIC;
-			} else {
-				const rendered = await agent.packs.getRendered(params.renderedPackId);
-				if (!rendered.content?.trim()) throw new Error(`rendered pack ${params.renderedPackId} has empty content`);
-				const sourcePack = await agent.packs.get(rendered.sourcePackId, { expand: "entries" });
-				if (!sourcePack.entries || sourcePack.entries.length === 0) throw new Error(`source pack ${rendered.sourcePackId} has no entries`);
-				sourceEntriesMd = buildSourceEntriesMarkdown(sourcePack.entries.map((entry) => ({
-					title: entry.entry.title,
-					content: entry.entry.content
-				})));
-				renderedContent = rendered.content;
-				rubric = params.rubric?.trim() ? params.rubric : DEFAULT_RUBRIC;
-			}
+			const claimed = await agent.tasks.claim(params.taskId);
+			const input = claimed.task.input;
+			const rendered = await agent.packs.getRendered(input.renderedPackId);
+			if (!rendered.content?.trim()) throw new Error(`rendered pack ${input.renderedPackId} has empty content`);
+			const sourcePack = await agent.packs.get(input.sourcePackId, { expand: "entries" });
+			if (!sourcePack.entries || sourcePack.entries.length === 0) throw new Error(`source pack ${input.sourcePackId} has no entries`);
+			const sourceEntriesMd = buildSourceEntriesMarkdown(sourcePack.entries.map((entry) => ({
+				title: entry.entry.title,
+				content: entry.entry.content
+			})));
+			const rubric = params.rubricOverride?.trim() || input.rubric?.preamble?.trim() || DEFAULT_RUBRIC;
 			let scores;
 			try {
 				scores = await runFidelityJudge({
 					model,
 					sourceEntries: sourceEntriesMd,
-					renderedContent,
+					renderedContent: rendered.content,
 					rubric
 				});
 			} catch (err) {
+				await agent.tasks.fail(params.taskId, claimed.attempt.attemptN, { error: {
+					code: "judge_failed",
+					message: err.message ?? String(err)
+				} }).catch(() => {});
 				throw new Error(`judge failed: ${err.message ?? String(err)}`);
 			}
-			if (!params.nonce) return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({
-						mode: "local",
-						renderedPackId: params.renderedPackId,
-						scores
-					}, null, 2)
-				}],
-				details: {}
+			const modelId = model.provider && model.id ? `${model.provider}:${model.id}` : model.id ?? "pi:unknown";
+			const output = {
+				scores: [
+					{
+						criterionId: "coverage",
+						score: scores.coverage
+					},
+					{
+						criterionId: "grounding",
+						score: scores.grounding
+					},
+					{
+						criterionId: "faithfulness",
+						score: scores.faithfulness
+					}
+				],
+				composite: scores.composite,
+				verdict: scores.reasoning,
+				judgeModel: modelId
 			};
-			const recipe = computePiJudgeRecipeCid({
-				judgePrompt: JUDGE_SYSTEM_PROMPT,
-				rubric,
-				promptAsset: JUDGE_PROMPT_ASSET_PATH,
-				rubricAsset: RUBRIC_ASSET_PATH
-			});
-			const providerName = model.provider ?? "pi";
-			const modelId = model.id ?? "unknown";
-			const submit = await agent.packs.submitVerification(params.renderedPackId, {
-				nonce: params.nonce,
-				coverage: scores.coverage,
-				grounding: scores.grounding,
-				faithfulness: scores.faithfulness,
-				transcript: scores.reasoning,
-				judgeModel: modelId,
-				judgeProvider: providerName,
-				judgeBinaryCid: recipe.cid
+			const outputCid = await computeJsonCid(output);
+			const completed = await agent.tasks.complete(params.taskId, claimed.attempt.attemptN, {
+				output,
+				outputCid,
+				usage: {
+					inputTokens: 0,
+					outputTokens: 0
+				}
 			});
+			await agent.packs.updateRendered(input.renderedPackId, { verifiedTaskId: params.taskId });
 			return {
 				content: [{
 					type: "text",
 					text: JSON.stringify({
-						mode: "proctored",
-						renderedPackId: params.renderedPackId,
+						renderedPackId: input.renderedPackId,
+						taskId: params.taskId,
 						scores,
-						submission: submit,
-						judgeRecipeCid: recipe.cid,
-						judgeRecipeManifest: recipe.manifest
+						task: completed
 					}, null, 2)
 				}],
 				details: {}
@@ -8081,7 +7856,7 @@ function createMoltNetTools(config) {
 		renderPack,
 		listRenderedPacks,
 		getRenderedPack,
-		verifyRenderedPack,
+		createJudgePackTask,
 		judgeRenderedPack,
 		diaryTags,
 		listEntries,
@@ -8697,6 +8472,272 @@ function ensureRelativeWorktreePaths(gitconfig) {
 	return `${gitconfig}${gitconfig.endsWith("\n") ? "" : "\n"}[worktree]\n\tuseRelativePaths = true\n`;
 }
 //#endregion
+//#region src/moltnet/judge-recipe-cid.ts
+var require = createRequire(import.meta.url);
+var SELF_PACKAGE_NAME = "@themoltnet/pi-extension";
+var PI_PACKAGE_NAME = "@mariozechner/pi-coding-agent";
+var SDK_PACKAGE_NAME = "@themoltnet/sdk";
+var CID_VERSION = 1;
+var RAW_CODEC = 85;
+var SHA2_256_CODE = 18;
+var BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+function findSelfPackageDir() {
+	const start = path.dirname(fileURLToPath(import.meta.url));
+	let dir = start;
+	while (true) {
+		const candidate = path.join(dir, "package.json");
+		if (existsSync(candidate)) {
+			if (JSON.parse(readFileSync(candidate, "utf8")).name === SELF_PACKAGE_NAME) return dir;
+		}
+		const parent = path.dirname(dir);
+		if (parent === dir) return start;
+		dir = parent;
+	}
+}
+var PACKAGE_DIR = findSelfPackageDir();
+function sha256Hex(value) {
+	return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function encodeVarint(value) {
+	const bytes = [];
+	let current = value >>> 0;
+	while (current >= 128) {
+		bytes.push(current & 127 | 128);
+		current >>>= 7;
+	}
+	bytes.push(current);
+	return bytes;
+}
+function base32Lower(bytes) {
+	let bits = 0;
+	let value = 0;
+	let output = "";
+	for (const byte of bytes) {
+		value = value << 8 | byte;
+		bits += 8;
+		while (bits >= 5) {
+			output += BASE32_ALPHABET[value >>> bits - 5 & 31];
+			bits -= 5;
+		}
+	}
+	if (bits > 0) output += BASE32_ALPHABET[value << 5 - bits & 31];
+	return `b${output}`;
+}
+function stableStringify(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+	return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+}
+function readPackageVersion(pkgPath, expectedName) {
+	if (!existsSync(pkgPath)) return null;
+	const parsed = JSON.parse(readFileSync(pkgPath, "utf8"));
+	if (expectedName && parsed.name !== expectedName) return null;
+	return typeof parsed.version === "string" ? parsed.version : null;
+}
+function resolveInstalledPackageVersion(packageName) {
+	const candidates = [];
+	try {
+		candidates.push(path.dirname(require.resolve(packageName)));
+	} catch {}
+	let dir = PACKAGE_DIR;
+	while (true) {
+		candidates.push(path.join(dir, "node_modules", packageName));
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	for (const start of candidates) {
+		let current = start;
+		while (true) {
+			const version = readPackageVersion(path.join(current, "package.json"), packageName);
+			if (version) return version;
+			const parent = path.dirname(current);
+			if (parent === current) break;
+			current = parent;
+		}
+	}
+	return null;
+}
+function resolvePiJudgeRecipeVersions() {
+	return {
+		pi: resolveInstalledPackageVersion(PI_PACKAGE_NAME),
+		piExtension: readPackageVersion(path.join(PACKAGE_DIR, "package.json"), SELF_PACKAGE_NAME),
+		sdk: resolveInstalledPackageVersion(SDK_PACKAGE_NAME)
+	};
+}
+function buildPiJudgeRecipeManifest(inputs) {
+	return {
+		kind: "pi-judge-recipe/v1",
+		versions: {
+			...resolvePiJudgeRecipeVersions(),
+			...inputs.overrides
+		},
+		assets: {
+			promptAsset: inputs.promptAsset ?? null,
+			rubricAsset: inputs.rubricAsset ?? null,
+			skillSourcePath: inputs.skillSourcePath ?? null
+		},
+		hashes: {
+			judgePromptSha256: sha256Hex(inputs.judgePrompt),
+			rubricSha256: sha256Hex(inputs.rubric),
+			skillFragmentSha256: inputs.skillFragment ? sha256Hex(inputs.skillFragment) : null,
+			implementationSha256: inputs.implementationSource ? sha256Hex(inputs.implementationSource) : null
+		}
+	};
+}
+function computePiJudgeRecipeCid(inputs) {
+	const manifest = buildPiJudgeRecipeManifest(inputs);
+	const manifestBytes = Buffer.from(stableStringify(manifest), "utf8");
+	const digestBytes = createHash("sha256").update(manifestBytes).digest();
+	return {
+		cid: base32Lower(Uint8Array.from([
+			...encodeVarint(CID_VERSION),
+			...encodeVarint(RAW_CODEC),
+			...encodeVarint(SHA2_256_CODE),
+			...encodeVarint(digestBytes.length),
+			...digestBytes
+		])),
+		manifest
+	};
+}
+//#endregion
+//#region src/otel/index.ts
+var TRACER_NAME = "@themoltnet/pi-extension/otel";
+function stripReservedAttrs(attrs) {
+	const out = {};
+	for (const [k, v] of Object.entries(attrs)) {
+		if (k.startsWith("gen_ai.")) continue;
+		out[k] = v;
+	}
+	return out;
+}
+function createPiOtelExtension(options = {}) {
+	return function piOtelExtension(pi) {
+		const tracer = trace.getTracer(TRACER_NAME);
+		const extraAttrs = stripReservedAttrs(options.spanAttributes ?? {});
+		let sessionSpan;
+		let sessionCtx = context.active();
+		let turnSpan;
+		let turnCtx = context.active();
+		let currentModel;
+		const toolSpans = /* @__PURE__ */ new Map();
+		function drainToolSpans(reason) {
+			for (const [, entry] of toolSpans) {
+				entry.span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: reason
+				});
+				entry.span.end();
+			}
+			toolSpans.clear();
+		}
+		function endTurnSpan() {
+			if (!turnSpan) return;
+			drainToolSpans("tool span not closed before turn end");
+			turnSpan.end();
+			turnSpan = void 0;
+			turnCtx = sessionCtx;
+		}
+		function endSessionSpan() {
+			drainToolSpans("tool span not closed before session shutdown");
+			endTurnSpan();
+			if (sessionSpan) {
+				sessionSpan.setStatus({ code: SpanStatusCode.OK });
+				sessionSpan.end();
+				sessionSpan = void 0;
+				sessionCtx = context.active();
+			}
+			currentModel = void 0;
+		}
+		pi.on("session_start", (event, ctx) => {
+			endSessionSpan();
+			const agentName = options.agentName ?? "pi";
+			sessionSpan = tracer.startSpan(`invoke_agent ${agentName}`, { attributes: {
+				...extraAttrs,
+				"gen_ai.operation.name": "invoke_agent",
+				"gen_ai.agent.name": agentName,
+				"session.reason": event.reason,
+				"session.cwd": ctx.cwd
+			} }, context.active());
+			sessionCtx = trace.setSpan(context.active(), sessionSpan);
+			turnCtx = sessionCtx;
+		});
+		pi.on("session_shutdown", () => {
+			endSessionSpan();
+		});
+		pi.on("model_select", (event) => {
+			currentModel = {
+				provider: event.model.provider,
+				id: event.model.id
+			};
+			if (sessionSpan) {
+				sessionSpan.setAttribute("gen_ai.request.model", event.model.id);
+				sessionSpan.setAttribute("gen_ai.provider.name", event.model.provider);
+			}
+		});
+		pi.on("turn_start", (event) => {
+			if (!sessionSpan) return;
+			const modelLabel = currentModel?.id ?? "unknown";
+			turnSpan = tracer.startSpan(`chat ${modelLabel}`, { attributes: {
+				...extraAttrs,
+				"gen_ai.operation.name": "chat",
+				"gen_ai.request.model": currentModel?.id ?? "unknown",
+				"gen_ai.provider.name": currentModel?.provider ?? "unknown",
+				"turn.index": event.turnIndex
+			} }, sessionCtx);
+			turnCtx = trace.setSpan(sessionCtx, turnSpan);
+		});
+		pi.on("turn_end", (event) => {
+			if (!turnSpan) return;
+			const usage = extractUsage(event.message);
+			if (usage) {
+				turnSpan.setAttribute("gen_ai.usage.input_tokens", usage.input);
+				turnSpan.setAttribute("gen_ai.usage.output_tokens", usage.output);
+			}
+			turnSpan.setAttribute("turn.tool_results", event.toolResults?.length ?? 0);
+			turnSpan.setStatus({ code: SpanStatusCode.OK });
+			endTurnSpan();
+		});
+		pi.on("tool_execution_start", (event) => {
+			const parentCtx = turnSpan ? turnCtx : sessionCtx;
+			const span = tracer.startSpan(`execute_tool ${event.toolName}`, { attributes: {
+				...extraAttrs,
+				"gen_ai.operation.name": "execute_tool",
+				"gen_ai.tool.name": event.toolName,
+				"gen_ai.tool.call.id": event.toolCallId
+			} }, parentCtx);
+			toolSpans.set(event.toolCallId, {
+				span,
+				startedAt: Date.now()
+			});
+		});
+		pi.on("tool_execution_end", (event) => {
+			const entry = toolSpans.get(event.toolCallId);
+			if (!entry) return;
+			const durationMs = Date.now() - entry.startedAt;
+			entry.span.setAttribute("tool.duration_ms", durationMs);
+			if (event.isError) {
+				entry.span.setAttribute("error.type", "tool_execution_error");
+				entry.span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: "tool execution failed"
+				});
+			} else entry.span.setStatus({ code: SpanStatusCode.OK });
+			entry.span.end();
+			toolSpans.delete(event.toolCallId);
+		});
+	};
+}
+function extractUsage(message) {
+	if (!message || typeof message !== "object" || !("usage" in message) || !("role" in message)) return null;
+	const msg = message;
+	if (msg.role !== "assistant" || !msg.usage) return null;
+	return {
+		input: msg.usage.input ?? 0,
+		output: msg.usage.output ?? 0
+	};
+}
+//#endregion
 //#region ../tasks/src/formats.ts
 /**
 * Register TypeBox string formats used across Task / TaskOutput / task-type
@@ -10001,6 +10042,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		sandboxConfig: opts.sandboxConfig
 	});
 	const diaryId = task.diaryId ?? "";
+	const taskTeamId = task.teamId ?? "";
 	let reporterOpen = false;
 	let session = null;
 	const finalUsage = emptyUsage(opts.provider, opts.model);
@@ -10063,6 +10105,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			const moltnetTools = createMoltNetTools({
 				getAgent: () => moltnetAgent,
 				getDiaryId: () => diaryId,
+				getTeamId: () => taskTeamId,
 				getSessionErrors: () => [],
 				clearSessionErrors: () => {},
 				getHostCwd: () => mountPath,
@@ -10072,7 +10115,15 @@ async function executePiTask(claimedTask, reporter, opts) {
 			const modelHandle = getModel(opts.provider, opts.model);
 			const resourceLoader = new DefaultResourceLoader({
 				cwd: mountPath,
-				agentDir: piAuthDir
+				agentDir: piAuthDir,
+				extensionFactories: [createPiOtelExtension({
+					agentName: opts.agentName,
+					spanAttributes: {
+						"moltnet.task.id": task.id,
+						"moltnet.task.attempt": attemptN,
+						"moltnet.task.type": task.taskType
+					}
+				})]
 			});
 			await resourceLoader.reload();
 			session = (await createAgentSession({
@@ -10189,10 +10240,16 @@ async function executePiTask(claimedTask, reporter, opts) {
 		if (reporterOpen) {
 			try {
 				await reporter.finalize(finalUsage);
-			} catch {}
+			} catch (err) {
+				const detail = err instanceof Error ? err.message : String(err);
+				console.error(`executePiTask: reporter.finalize() failed for task ${task.id} attempt ${attemptN}: ${detail}`);
+			}
 			try {
 				await reporter.close();
-			} catch {}
+			} catch (err) {
+				const detail = err instanceof Error ? err.message : String(err);
+				console.error(`executePiTask: reporter.close() failed for task ${task.id} attempt ${attemptN}: ${detail}`);
+			}
 		}
 		await managed.vm.close();
 	}
@@ -10281,6 +10338,7 @@ function moltnetExtension(pi) {
 	let worktreePath = null;
 	let moltnetAgent = null;
 	let diaryId = null;
+	let teamId = null;
 	let hostExecBaseEnv = HOST_EXEC_DEFAULT_BASE_ENV;
 	async function ensureVm(ctx) {
 		if (vm) return vm;
@@ -10335,6 +10393,7 @@ function moltnetExtension(pi) {
 			activateAgentEnv(managed.credentials.agentEnv, mainRepo);
 			moltnetAgent = await connect({ configDir: managed.agentDir });
 			diaryId = managed.credentials.agentEnv.MOLTNET_DIARY_ID ?? null;
+			teamId = managed.credentials.agentEnv.MOLTNET_TEAM_ID ?? null;
 			hostExecBaseEnv = new Set([...HOST_EXEC_DEFAULT_BASE_ENV, ...Object.keys(managed.credentials.agentEnv)]);
 			vm = managed.vm;
 			const label = worktreePath ? `${mountPath} → ${GUEST_WORKSPACE}` : `${localCwd} → ${GUEST_WORKSPACE}`;
@@ -10356,6 +10415,7 @@ function moltnetExtension(pi) {
 			vm = null;
 			vmStarting = null;
 			moltnetAgent = null;
+			teamId = null;
 		}
 	});
 	pi.on("before_agent_start", async (event, ctx) => {
@@ -10395,6 +10455,7 @@ function moltnetExtension(pi) {
 	const moltnetTools = createMoltNetTools({
 		getAgent: () => moltnetAgent,
 		getDiaryId: () => diaryId,
+		getTeamId: () => teamId,
 		getSessionErrors: () => sessionErrors,
 		clearSessionErrors: () => {
 			sessionErrors.length = 0;
@@ -10506,4 +10567,4 @@ function moltnetExtension(pi) {
 	registerMoltnetReflectCommand(pi, state);
 }
 //#endregion
-export { HOST_EXEC_DEFAULT_BASE_ENV, activateAgentEnv, buildPiJudgeRecipeManifest, computePiJudgeRecipeCid, createGondolinBashOps, createGondolinEditOps, createGondolinReadOps, createGondolinWriteOps, createMoltNetTools, createPiTaskExecutor, moltnetExtension as default, ensureSnapshot, executePiTask, findMainWorktree, loadCredentials, resolvePiJudgeRecipeVersions, resumeVm, toGuestPath };
+export { HOST_EXEC_DEFAULT_BASE_ENV, activateAgentEnv, buildPiJudgeRecipeManifest, computePiJudgeRecipeCid, createGondolinBashOps, createGondolinEditOps, createGondolinReadOps, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiTaskExecutor, moltnetExtension as default, ensureSnapshot, executePiTask, findMainWorktree, loadCredentials, resolvePiJudgeRecipeVersions, resumeVm, toGuestPath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "license": "MIT",
@@ -29,9 +29,10 @@
   },
   "dependencies": {
     "@earendil-works/gondolin": "^0.7.0",
+    "@opentelemetry/api": "^1.9.0",
     "@sinclair/typebox": "^0.34.0",
-    "@themoltnet/sdk": "0.94.0",
-    "@themoltnet/agent-runtime": "0.2.0"
+    "@themoltnet/agent-runtime": "0.3.0",
+    "@themoltnet/sdk": "0.95.0"
   },
   "peerDependencies": {
     "@mariozechner/pi-coding-agent": ">=0.67.0",
@@ -48,6 +49,7 @@
   "devDependencies": {
     "@mariozechner/pi-ai": "^0.67.68",
     "@mariozechner/pi-coding-agent": "^0.67.68",
+    "@opentelemetry/sdk-trace-base": "^2.5.1",
     "@types/node": "^20.11.0",
     "typescript": "^5.3.3",
     "vite": "^8.0.0",